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Introduction 

This chapter describes the typical hazards that can be expected to be encountered when processing 
payloads on the ground. Also described are some of the more common controls for these hazards. 
Many of these controls are based on hard requirements but they are also based on specific lessons 
learned. This chapter uses the term Flight Hardware (F/H) for all payloads regardless of size. 

Flight Hardware (F/H) 

Flight Hardware Hazards in the Ground Environment 

Flight hardware is that equipment which is designed for on-orbit operations. Safety requirements for 
F/H are described in other chapters and books. Throughout this chapter those hazards which apply to 
F/H while performing ground processing will be discussed where appropriate. These hazards include 
such categories as electrical systems, Composite Overwrapped Pressure Vessels and ground handling. 

Design standards for F/H are determined by the Program or Project based on the needs of the mission. 
However, ground safety standards may also be applicable and need to be included early in the design 
phase. Failure to account for ground safety requirements may necessitate a re-design effort or an 
increase in risk to the mission. Designers need also to take into account, that if the F/H is going to be 
processed at multiple locations, then compliance with each location's safety requirements is required. 

Ground Support Equipment (GSE) 

Ground Support Hazards 

Ground Support Equipment can be defined as all non-flight hardware and software that is used to 
support the transporting, receiving, handling, assembly, testing, checkout, servicing, launch, recovery 
and post flight processing of space vehicles and payloads at the launch, landing, and retrieval sites. GSE 
does not necessarily have to provide a direct connection to the flight hardware to be considered GSE. 
For example, communication hardware that can provide radio frequency transmission commands to the 
flight hardware during processing operations is considered GSE. GSE may also be called other terms 
such as factory equipment, test equipment, special test equipment, support equipment, processing 
equipment, and commercial off the shelf (COTS) equipment. Generally, the scope of the GSE will be 


defined by the program or project as well as the safety requirements. The GSE requirements used to 
process the flight hardware at the manufacturing, development, or test facilities may also be specified 
by the program or project. 

The safety requirements for GSE will be specified by the program or project organization responsible for 
the flight hardware and, at a minimum, contain those requirements specified by the processing or 
launch site. Examples of requirements documents include CNES CSG-RS-33A-CN, JAXA JMR-002 and 
USAF AFSPCMAN 91-710. Generally, the GSE is designed and operated in accordance with the national 
laws and consensus standards of the country of origin, subject to local processing site requirements. 
Modifications to GSE that comply with the national standards where the GSE was manufactured are 
normally not required to comply with the additional safety requirements imposed for GSE when the GSE 
is used in another country. 

A safety process will be established to ensure the customer's GSE complies with the appropriate safety 
requirements. The requirements should state what safety documentation is required to be submitted to 
the program or project and what type of safety review process will be used to approve the customer 
GSE. The safety reviews may be held in a safety review panel forum with representatives from the 
customer and a panel of safety experts representing the program or project. 

The timing of the safety reviews and for the delivery of the associated safety documentation is linked 
typically to major program milestones. The safety documentation is reviewed to provide assurance that 
hazard causes have been identified and controlled to an acceptable level and that a scheme is in place to 
ensure the controls are verified prior to the start of the associated operations. The results of these 
reviews are presented to program management, processing and launch complex operators, and 
sponsoring agencies for approval. The results will also identify any risks that must be accepted by the 
program or project. Risks are typically catastrophic or critical hazards with very high or high likelihoods 
of occurrence that could result in loss of mission, damage to flight hardware, damage to facilities, or 
injury or death to personnel. The complexity of the documentation and the required submittal dates 
and processes vary with each mission. Early contact with approving authorities is recommended to 
establish an understanding of applicable requirements and expectations. 

Ground Support Equipment General Design Practices 

When considering the GSE to be used in the processing of flight hardware, the customer should pay 
close attention to the operating environment where the GSE will be used. The natural geographical 
environment where the GSE is designed to function will play a role in the design of the GSE. GSE which 
must be used outside must consider the effects of salt spray, sun exposure, rain, snow, etc. Sunlight 
could affect the ability of the workers to read digital readouts, so human factor issues are an important 
part of environmental considerations. GSE designed to function in hazardous atmospheres must be 
compatible with the materials present and also fire/explosion proof as required. GSE in a clean room 
environment must be compatible with the cleanliness level necessary for the flight hardware. GSE may 
require other special environmental considerations such as design for seismic environments if used in 
earthquake zones or temperature extremes to match the processing and landing site environments. 


Good sources of information for GSE are lessons learned data bases and mishap data bases from 
previous programs. For example, during the ground processing of a NASA payload, a mishap occurred 
involving the inadvertent attempted mating of an energized electrical connector from a spacecraft 
battery. The technician attempted to mate the pin side of the connector to the socket side of the 
connector in an area of the spacecraft where the technician could not visually see the socket side of the 
connector. As a result, he inadvertently scooped the energized pins against the shell of the wrong 
connector which shorted out the battery. A small fire resulted which damaged the battery and the 
electrical arc damaged the connectors. This mishap resulted in a change to the NASA GSE payload safety 
requirements imposing the use of scoop proof keyed connectors for all energized connections. 

Other lessons learned are gained from real life operational experiences. One payload customer built a 
fluid servicing cart that was intended to be rolled around on wheels for ease of transportability to the 
flight hardware and the fluid servicing area. However, the cart designer forgot to include the weight of 
the fluid when selecting the size of the wheels. When the cart was fully loaded with fluid, the weight of 
the cart exceeded the load capacity of the wheels. As a result, the cart was placed on wood blocks after 
filling to take the weight off of the wheels and the cart was no longer portable. Designers need to 
consider maximum gross weight when designing stands, carts, and lifting equipment. 

One last note concerning fluid carts. If the cart also has electrical power connections, make sure the 
electrical connections are all located higher than the fluid connections. In this situation, a fluid leak will 
not drip on an electrical connection which could result in a shock or fire hazard. 

During typical payload processing flows, the GSE is used for a few months to process the payload at the 
launch site and then returned to the customer facility never to be brought back to the launch site again. 
In some processing flows, the GSE may be used for several repetitive operations, or the GSE may be 
used for a series of flight hardware missions. If the GSE is to be used long term, consideration must be 
given to ongoing operation and maintenance of the GSE. For the processing of Space Shuttle payload 
GSE, the safety requirements did not address long term usage of GSE like occurred during the processing 
of International Space Station (ISS) flight hardware. As a result, during the later stages of ISS processing, 
as GSE began to show signs of wear and tear, data to support advanced maintenance and repair was 
difficult to obtain due to the completion of the original contracts. 

Ground Support Equipment Design Details 

This section will discuss the different categories and subsystems of GSE. Key safety considerations will 
be provided as well as lessons learned. 

Biomedical Systems and Materials 

Biomedical systems cover the range from plant life to animal life to experiments performed on the flight 
crew. Hardware containing biological material requires special attention because of the possibility of 
injuring the flight or ground crew. Remember to ask for Material Safety Data Sheets (MSDS) or similar 
information when obtaining biological samples, as this data is frequently available from the supplier. 


Although a biological experiment or sample may have a low toxicity on orbit, this does not mean that 
the experiment or sample has a low toxicity on the ground during pre flight or post landing ground 
processing. Concentrated acids or fixatives may be used to prepare or process the biological samples on 
the ground which are hazardous to the ground processing personnel. The ground safety hazard analysis 
must consider how the ground processing personnel are protected from exposure to the chemicals used 
to process the biological samples and exposure to the samples themselves. 

The handling of trash returning from space requires careful planning. There have been cases of ground 
personnel stuck by 'used syringe needles because such trash was not segregated properly on orbit prior 
to landing. A plan for marking and handling trash must be developed prior to launch to ensure 
protection of ground personnel after landing. 

Electrical 

In general, electrical GSE should be designed and operated in accordance with the national safety and 
consensus standards from the country of origin. For the United States, this means the GSE should 
comply with the National Electric Code (National Fire Protection Association Standard No. 70) and have 
an Underwriter's Laboratory (UL) label. The GSE should only be used within the manufacturer's 
guidelines. Any modifications will require an additional hazard analysis. Electrical GSE used in a 
different environment than intended may require additional safeguards such as hazard proofing or 
purging to prevent fire or explosion. 

Electrical connectors shall be designed to make it physically impossible to inadvertently reverse a 
connection or mate the wrong connectors if a hazardous condition can be created. The connectors for 
energized circuits should be of a scoop proof design to prevent an inadvertent mismate as discussed 
earlier. Construction of the payload and the electrical GSE shall assure that all conductive external parts 
and surfaces are at ground potential at all times. 

Another lesson learned is to be careful when using three phase power GSE. There have been incidents 
when three phase electrical GSE was mated to facility power connections that had a different phase 
rotation. When the GSE was powered up, the GSE was damaged because the GSE motor was wired for a 
different three phase rotation than the facility power provided. Remember to check the three phase 
power rotation from the facility before connecting three phase power GSE so that the phase rotations 
match between the facility and the GSE. 

Special attention should be given to battery charging and conditioning operations. Continuous 
monitoring by personnel should occur during spacecraft battery charging and conditioning operations. 
The battery charging GSE should incorporate devices to protect the batteries such as fuses, diodes, 
voltage and current limiters, and temperature and pressure monitors. 

Pressure Systems 

Most countries have national standards or consensus standards for the design of pressure vessels and 
pressure systems used in ground systems. These standards should be used as the basis for the design of 


the pressure GSE used to process the flight hardware at the launch site and the manufacturing facility. 
Consult with the program or project as the safety requirements imposed on the pressure GSE may 
include additional requirements in the areas, for example, of testing, marking, or color coding. 

Consider human factors when selecting and locating pressure gauges in the GSE. Gauges should be 
clearly readable from where the operator normally is located to operate the pressure GSE. Lighting may 
be necessary on the panel to assist in reading the gauges. Gauges have sometimes been selected which 
cannot provide the level of accuracy needed to read the pressure value. Gauges should have blow out 
backs so that if they receive excessive pressure, they will vent away from the operator. 

Pressure GSE used for multiple fluids should be designed with different sized connectors, keying, etc. to 
make it physically impossible to mix fluids which could result in a hazardous condition. Flexible hoses 
rated for use above 150 psi (1034 kPa) should be restrained at connections, across unions, and every six 
feet (1.8 m) to prevent whipping in case of inadvertent disconnect while under pressure. The hoses 
should be placed in a manner to eliminate tripping hazards to personnel. 

Special care should be taken to ensure that any venting done by a pressure system, whether planned or 
unplanned, is done in such a way as to not create a hazardous condition. If venting into the work area, 
the vents should be configured so that the discharge is directed away from personnel. Work should 
never be accomplished on a pressurized system without first venting the pressure out of the system. 

The use of composite overwrapped pressure vessels (COPVs) in flight hardware requires special 
attention during ground processing. Because COPVs are very sensitive to impact damage, the program 
should require a mechanical damage control plan for the COPVs that explains in detail how the COPVs 
will be protected from the time of arrival at the assembly site through launch. The COPVs may also 
require a certified inspection after transportation to the launch site. 

Explosives 

Explosive devices are generally divided into two categories: Category A and Category B. Category A 
electro explosive devices (EEDs) are ones that by expending their own energy, or initiating a chain of 
events, may cause injury or death, loss of life, or damage to hardware or property. Category B devices 
are ones that will not, by expending their own energy, or initiating a chain of events, cause injury to 
people or damage to hardware or property. There are cases where an EED may be one category during 
ground processing and then become a different category after installation into the flight hardware; after 
integration of the payload to the launch vehicle or prior to launch. 

All explosive devices must be stored, shipped, and handled, in a manner consistent with their hazard 
level and classification. Faraday caps must be installed on ordnance until electrical connections are 
made. Explosive test equipment must limit the energy input to the EED. 

Explosive devices and systems are required to be designed to preclude inadvertent firing when 
subjected to environments, including shock, vibration, and static electricity that can be encountered 
during ground processing. Explosive circuits, hardware design, and accessibility must permit interrupts 


such as safe plugs or safe and arm devices as close to the explosive devices as possible. Final 
connections should be made as late as possible prior to launch. 

Mechanical and Electromechanical Devices 

Flight hardware that contains deployment mechanisms must have all necessary controls in place to 
prevent inadvertent activation. These mechanisms include such items as solar arrays or sample 
gathering devices. Even if the deployment is non-hazardous, controls are highly recommended to 
promote mission success. 

Regarding solar arrays, remember that solar arrays exposed to facility lighting can generate electricity. 
Solar arrays should be kept covered or routed to load resistors to prevent a shock hazard to personnel 
or damage to equipment. 

Propellants 

The materials used in liquid propellant systems must be compatible with the type of liquid propellant 
used. The type of fluids used in launch vehicles and spacecraft liquid propellant systems can vary widely 
from inert gases to highly hazardous hypergolic fluids. Since each of these fluids has distinct physical 
and reactive properties, it is important to follow the guidelines contained in the Material Safety Data, 
Sheets or similar data sheets and to develop the hazard analysis and safety considerations accordingly. 

When dealing with solid propellants, following the requirements related to explosive and electrical 
safety are important. The most critical hazard faced is the control of electrostatic discharge or ESD. This 
hazard can occur through the environment (lightning), electrical systems or materials used during 
processing (plastic films). 

Safety considerations for both liquid and solid propellants include the proper storage, transfer, and 
handling of propellants, separation from reactive materials, capability to isolate leaks, purging, spill 
containment, clean up, and electrostatic properties of materials. Emphasis is placed on personnel 
protection during propellant operations, toxic vapor detection, asphyxiation hazards, venting and 
scrubbing of vapors, explosion proofing of electrical equipment, and emergency planning. 

There are several lessons learned available that can be studied where lives were lost as the result of 
asphyxiation or electrostatic discharge mishaps in this area. 


Cryogenics 

In general, cryogenic systems must comply with the same requirements as those which apply for 
propulsion systems and pressure systems. Due to their unique physical properties, some additional 
requirements are also imposed. Cryogenic systems shall provide for thermal contraction and expansion 
without imposing excessive loads on the system. Cryogenic GSE systems shall be insulated with an 
oxygen compatible material or be vacuum jacketed to prevent liquefaction of air. The use of pressure 


relief devices is required in parts of the system where conversion from liquid to gas can create a 
pressure rise issue. This issue may also be resolved by the draining of cryogenic lines after completion 
of the operation. 

Oxygen 

The use of gaseous or liquid oxygen involves unique design requirements with respect to material 
compatibility. Metals, soft goods in valve components, and lubricants must be carefully selected to 
ensure compatibility with oxygen. Cleanliness of oxygen systems is extremely important because 
contamination and particles can ignite when impacted against components in the GSE or flight 
hardware. During operations, valves should be required to open and close slowly, and the oxygen flow 
rates should be kept to flow rates less than 100 feet/second to prevent an adiabatic compression 
hazard. 

Oxygen systems should be analyzed to ensure leak prevention, adequate ventilation, suitable design of 
system components, and system cleanliness. Systems should be designed with sufficient redundancy to 
provide adequate failure tolerance and personnel safety. 

Ground Handling 

The attach points for flight hardware used during ground lifting operations generally use either the 
attach points for connecting the flight hardware to the launch vehicle, or special attach fittings added 
solely for lifting operations that are later removed before flight. When utilizing the flight attach points, 
the flight dynamic structural analysis must include enough safety margins to account for the ground 
lifting load. When special attach fittings are used, an analysis is required to verify the load paths have 
adequate safety factors for ground handling. Be careful if the attach points are located below the center 
of gravity of the flight hardware. There has been at least one case where the flight hardware flipped 
over inside the sling during a crane move because the attach points were below the center of gravity of 
the flight hardware. 

Lifting GSE design should comply with the requirements of the country of origin and there may be 
additional program requirements imposed for testing and inspection of the GSE. Large pieces of lifting 
GSE may require disassembly for shipping to the launch site. A method is required to ensure the lifting 
equipment is reassembled correctly after arrival at the launch site for use. Methods to use to ensure 
reassembly include marking, tethering, labeling, and color coding. As a lessons learned, if color coding is 
used as the method of marking, make sure that the personnel performing the reassembly of the lifting 
device do not have color blindness. 

Software Safety 

Software continues to provide an increasing role in the design of flight and ground systems. Software is 
used to monitor the status of flight systems during ground processing and to load and verify the 
software installed on the flight computers. A safety assessment is required for the use of software 


during ground processing to ensure that the software does not contribute to a hazardous condition or 
cause one to occur. 

Potential hazards from software include inadvertent commanding, loss of command, out of sequence 
commands, human error, removal of inhibits, and coding errors. Commands could inadvertently open 
valves, power transmitters, start sequence timers, allow power to relays, and remove other system or 
safety inhibits. 

Integrated Hazards 

Integrated hazards are those hazards which occur across multiple items such as F/H to GSE or GSE to 
GSE and GSE to facilities. The most common integrated hazards occur at the interfaces, in the local 
environment and during launch and possible return. 

For interface hazards, examples such as the proximity of electrical and fluid connections and lifting 
points (both previously discussed), designers and analysts need to assure that both sides of the interface 
as well as across the interface are evaluated. End-to-end (i.e. from source to end point) analyses of fluid 
and electrical paths are highly recommended. 

Environmental hazards, such as adverse weather and hazardous atmospheres, tend to be operationally 
controlled; however, some can be designed out such as hazard-proofing electrical equipment. As these 
hazards can impact the facility, the facility will generally have specific requirements to be followed. 

During the launch and possible return phases of the mission, hazards may be imposed on the F/H from 
external sources (e.g. the launch vehicle). Designers and operators must work closely with the owners 
of those hazards to assure they are properly controlled and that any controls on the F/H are 
implemented. 

A corollary of integrated hazards is change control. Once permission has been obtained to start ground 
processing, any changes in equipment or operations must be re-assessed to assure the appropriate 
controls are in place or remain in place. Close coordination with the approval authority is required at 
. this point. Changes should not be implemented until the additional assessment is complete and 
approved. 

Summary 

This section highlighted some of the hazards to consider involving GSE and the, processing of flight 
hardware both prior to launch and during the post landing processing of the flight hardware. Some 
lessons learned were included from actual examples that have occurred. In some cases, the ground 
processing of the flight hardware may be more hazardous than the flight hazards during the on orbit 
portion of the mission. 



